CyberRota Analysis
AI-GeneratedThe vulnerability exists in libmodplug versions up to 0.8.9.1, where an out-of-bounds read in the pat_smplooped function can occur due to improper validation of the sample index, potentially leading to unintended manipulation of playback state. Specifically, a crafted MIDI file can exploit this flaw, causing the library to read from an invalid memory location, which may result in erratic behavior during audio playback. Developers and organizations utilizing libmodplug in audio processing applications should prioritize addressing this vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat_loops, so an index of zero reads pat_loops[-1], one byte before the array. The index is the smpno field of a parsed MIDI event, which is initialised to zero and only later overwritten from a program-change parameter, so an event reaching the note test before an instrument is assigned carries zero. A 32-byte MIDI file supplied to the library's public ModPlug_Load entry point drives the path through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns to the read. The byte read out of bounds determines whether a note event is treated as looping, so adjacent static storage influences playback state.